590d5c7ad5413d81bc8fd338a832c97cf442c3a2815f61379d52c051d5eb45fd

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Size 10.2MB
Sample261002-qm8avaba79
SHA256 590d5c7ad5413d81bc8fd338a832c97cf442c3a2815f61379d52c051d5eb45fd
MD5 6292f2d1b82a62c21c8b458c693778a3
SHA1 66a0680df606b9cb53b81f73d1206c2e0e3bc555
SHA512 e07860478f16f4e46b8d84bdb9afb554b5e279a94277b4e122f71cf2d10e8ac23d59e231ad1ff575154a4ee4b47d9e8243840c71520fbafd57a98de1435f1487
SSDEEP 196608:ikmXHJMW5giiMhSRI2CZCzh6T83MPDmKgV:TmXmW5giiYSRI2CZCQgMPCKa
TLSH
T173B6AF22B346C036E9A121F1695FBB5A22283D3A176088DFF1E19F6D11E56C34B35F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_1940352228\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_1940352228\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_278044664\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_2132539086\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_278044664\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_278044664\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_956954932\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_905228121\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_568180747\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_568180747\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_568180747\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_956954932\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_905228121\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_905228121\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_278044664\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_278044664\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_278044664\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_278044664\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_278044664\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_278044664\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_568180747\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_956954932\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_2132539086\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_2132539086\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_278044664\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_278044664\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_568180747\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_1940352228\manifest.json	msedgewebview2.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat. = "11001"	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies system certificate store 2 TTPs 12 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\85E2C5B0D9CFF505363FA62A5E8B8C1D76A60B46	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\4C7C2E87F0BC79A039D39B05F899A1CC521FDE99	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\A5C8D928986EC17FCC7D5F2353885D1709B73A29\Blob = 030000000100000014000000a5c8d928986ec17fcc7d5f2353885d1709b73a292000000001000000bc050000308205b8308203a0a00302010202047ce3bf47300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373137333831355a180f32303638303830343137333831355a30818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d313530820222300d06092a864886f70d01010105000382020f003082020a0282020100a0e7345276469020a420dfb0569684d7adf0f493a0a0a53742c25e1bf39a91a481ae07efcf40586a5b42a776dad12710078884bfcb2c3af2bdd70b4301490e58de99cb28b1dc5befd617dadfc34c653d9ef643ff6fd9069cb2ad740ebf1abc42c9fabb8a65cd0d76e9b0b64c77ec0e9350da1ba5f3aabbad9e076e2aebb3af34809dd50bb29cb26577536791a0c672c843fd11a60ce5aa99e0ac5ff81819ab8d4306e790040b6d9d4eb9e37b88d9bdfd8271ee8ba557aff9ec66da32c1f483cc84e0e9af352f5fd083e0933047a13529568e22491266b576b50af641676031593285135758d3f86467159b00ff3662b885dc7a331a1b658c42ae8e76101a67abf22002b4ccf330b966d05f63a91870ef56916ff131a0b8737e111413bc3620c593d5c1452012ec77d77b99240ab972c2fd0d20474bb9c63f1053cfded7de55d57e2d735ac280e1faa8f8af095fb29d5b03b7e45ff8c6d1a7c052e0854418d27c9adb3e40032000e988fd8f6f556bd956e85eed4e7c4d1916c4fc090c27e6b1a3bdaadf8eda48c81b212feee1f1b97ebe4b2ed98b49662c101efdb212720d73a7a432af6d816c7997a5485dae77209f060718e50c524d089750a51bfab47e04fccbf04017762c3597fa5b52b2394b7159053034065e17c184c25736ac793c6e2b25e04d59dc1fe74f9e338c719573d6d6b4b29ea7adbc259e5d4fb4d0fa89a92b0203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d05000382020100501c3b74f2e4857d8171cffe355895c8241c0590b0f5a81321aad9b328916dc68479ed41c47396336cae923db8c14276504c81f99ee5d961fae32ea75fa707717fe6d3a0cdea05bd40c1d69f21a619b09209f09be929c02125020d7eb9e94670ef57bc02080be6718832fd9f5e7fbfd1bd75c278665582452f66a282d7bcb7936bc336ff64ab06a4a5f12f4a4592dd13ac944fc5a2dd8b084fa429d2eecc10fd7e9a5be17b8c235a12c3e48e0df101837bcd4563cac3e02d7b93e172847881db7ed7e3c01e5e426fe51ee67262154daba09ea358bd10e8d10a9028e6dded33fa8c0b5e5e88d751a73bc68cbd30ebed017024affcc1a3942010531a398ea8120158d78c214e813d6023ec021e80967de3131284f80d0650b1a068d7c5e2bf7f8e019c70db26ee5f0d1719240c7a06c66344d95749b73aff74d6471d97297a248370f30b76d15d576e24fc4f2ac5960eb03d44d9fd145415eb99960802ff81c17439d9594187ffeb98e6e6f1ec11b44fb24eaadfcc1e9107e03eafb42bc717d3a0db4a73c66f0a22c7924a400b02742ea8609051927fac69131dba15df08d152e226764f30438bdb422a895c7d0e60b1da26370806914e4cc1dac1777385d470c81292d597def9c7bbdbca6ed5d8a36cbd97c159590fd075b93c32a22e2405fad8c239b66cdc016e3ffe13c191065ecfefcabdaac7164846611cf24ac9506e7af7	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\CRLs	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\CTLs	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\686DF0A4A89F7CB6BFB4D33C6A48E2EE5FB6C4FB	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\686DF0A4A89F7CB6BFB4D33C6A48E2EE5FB6C4FB\Blob = 030000000100000014000000686df0a4a89f7cb6bfb4d33c6a48e2ee5fb6c4fb2000000001000000c3050000308205bf308203a7a003020102020401cfbd1c300d06092a864886f70d01010d050030818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d3139301e170d3233303830373135313132375a170d3330303830353135313132355a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3830820222300d06092a864886f70d01010105000382020f003082020a0282020100d119f9b8d2d41d892abf9f1f3cd1f947141b9867e9be6d96e479c74c87e42f61f5b927bccb7caebe27b26465b8e2f1118c2041980b88d7f559b8f9d041110e19f29ce5033fe9b8184d47982257e97d1b62744521bc329a7861a2376eeb8f3248eb031a7b43b1f22174fcc3c642033770137cad8329b240970127edd3030d9a69af242fc7405b5867d0f5950bb0b79f702e84180ee43ca21f46adce07ad014f5cfd7be25e735eb0431889bcce40a4e94791fca5a65da24838d189b85218c9961eb1bce8db4cb2ffc7a2c3419788e68098350cacc6aa61dfb3d8476454927f9ab767037a84ed4e39862b3f386a065b169403259617150679e34af188035d8bebd9f4f22544cbf81f0d0516799d39a17a56c12e5c151945d65084367647c6f6a78ade46f7bcc0b8aca7d8abfe3eb34ab2d1fb7800a98da86c8da956b267e309634d55ff7f6570f9b926bd602d4a94e77c662d1479c576b972d87bb35ea634b5f676774d40e04a0a908948c269c7dc71778ed5d15d9b8f4519ee858bc273a49afc7a206afd97286716b832e64154a074305d7bbcb7f2205017d1ed5ca6e42edc6d35fabc88dd188028b15e5aa5296e12c03486a80a6e3cb0c001e4742b1edf02fa70c2ebdcbec606480054fc467729e99d1eb80bee04b36fb17c722068079146fde54b06c3ec5c4bafaf113d2000ef36aebe8454560e81d0cf982a798bae3c39cd430203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d050003820201006bf0137ee63d74f0df4ee19376625ac33574898a025b764e9bd69f8c7d9fa1c7f9b58f0355f206cab84927d626275a8fd0d1c6a3b9a7811b361a68523ad86199ec1188922ce525246bfef1b4dd23eb5b8ee0894d4495ceb1c0f27bca3812c7c02432f9a693c7a331c53162a76c687c0ff60b31389a0e11f9da1fd8ceae91ff671222083643e0a7c0b97f170ab051856ab58c8b3278d16753cfaac05cec9a08c0fcc2e993aaea79225d70e9ec8bfb53c93be8915b2026a35bf05d3c9e5e417fabc5648d9fd8f153e8787f1e3cdd637fe2abd8c8a5d1c9171c342e588a77ff2739dc6b88c79dc933dedf535c496ba652a184b6b65b831aa7706251494108d58f8565624e37a343696f2e42c029333dab8b1a9e34bda64b58546906e9bd3f0d67f3cb830e8b6bf3b01f653c938da93b53a6878a14fe75550b546d580fa40f0e6e6fac25113513f48c9fc79b27689b906afd59d11abbdf4fde466d2a93431606db3938d9e9f7505d1a0cd91e4f116a2f3e1837ba0c1ab0cc74724916a65d9b2c09b00eef96bda7156f789449923371b5aac2a6728b0b3e71ac656ebc820bad65977cebaf56611c8d322c78af95c5dc1c2e56d95eca6efb5664010860dd6c82faf60a9cd493eecc6b013449633928d96bb0d38f28f838564db989958ecfd5325fa51f8ec4148545c5a94705beb7200b427f978959cc7a031fe58f7e2f42ad48e3bb82	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\85E2C5B0D9CFF505363FA62A5E8B8C1D76A60B46\Blob = 03000000010000001400000085e2c5b0d9cff505363fa62a5e8b8c1d76a60b462000000001000000bc050000308205b8308203a0a003020102020426c66cd0300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373137333831395a180f32303638303830343137333831395a30818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d313930820222300d06092a864886f70d01010105000382020f003082020a0282020100b533b875034a0e7563110700e026d838b4ed1369ee54d6db09ebf764a4778ef8a7dc7dfba9386a78e61be8ff8722d2ca1535cc02c111f9fae54fdc09698d22d9d936b3133aab757b596a1c093cf3559f351d3f10dc44fb0f9787e1f685e83dc775c74d0e563f1509071a1d4bcd919d0b9ebaf925867a85e7e5b9b13040760dfbe2a9bd70e028963dd69631e9cf2f5ca3a6634ac8bfe2dae5cde9df35e935b4f88a17fc78786052badf6e5a378e34a16d16ec7eeb69bf0917fd7210ae129ae2b5f3473e28ea73e25e81176229f0ad99b74069cf6c30413ab85d86f7fec519e01806a928cf2e5ea9c9aae9f57a60401e76313fd017bbe23541b455da6c7d49e39f6b451a67ea2160056781067c489526d297410ac05e87fbeca66d75bda1eaeec9652891598957f4c19fb53ec491b1d600d1ad75d7c164d613ba6ce275682f44399515c247d11d72dc440fd800225a13ae8d16494eaa9f1f82120d2f51243683d2aa62cdcf5be075720b7d566eadb5e46ee3299b43296a49bf3fbe2e672e72e42e7918e608466028de4f215cd362cfd921200ff946168717d09af99095950812f5a4de4073e2c5697a318b9eb51a585a36e74dbd8fb7277c8aeb7ddd42ffbeb32c181f9edaddc1480b95f16e7ea37d0dab3f2f5009d570aa4624b66a7017c75f1caa7c544e15def0c6e6cf6a4f26312b68f633b7a5a4203c97e77a32141e7cf4970203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d050003820201005bd66c82ca184490136b886ef3b5f5b6866768c8cfd13f701025aeb8dc8b7b4539c071032663327f1b55d773e062ea01551038bc12895b4a760a23ec0ef1e24c1d25649b12dad880b576a952ba1f9d1ed0c5bdf45e8a9f9465c091e22ff7165912fba642b3e2979897339ab2ae511615d3e20b27e3e60e13fe188c7c7119f14029ccfaf1e9fef5c7e53ce1c0d1cfcb8507131c446af5b7f67b701e1ee4151cadd14048737cf0ec86f8964d75b8509bf07a984441641622568d5ea1b9124101db76c578bee86acdb651a90b5c3abdab541f3a41e82cbfc0d30319e1975924540a71e8d1a3603caade3cefcf0b362b62fa09efe97827276b0b79f58553136c89aa72a9f3f7fdaa87e5789978abe6af28c04f7d673954594329ace012159c5ee6b2cb43b55f507e0e0f68233e8a3c6fe13a2cb23b4f38ddecaeae21e99bd6e152793ad59b8286256ede041654cb8a7c069d773868f8bddea44fccdcfc4c0cfec6f9357093024d88519a40bdb3b77b0988051418fcba0a67c5caabc66f21d094e5d612dd7f951291892a4f8ef35efdb2c9d940fcbddfdb75d19b1b215a36dec147c9d716bb4a06047e90d0d0fad64a56f24a6b650843d5cdd2aba7e8894b4693d775aebc8d65063d1813b0be5c9c6357c43be7aea9b3b6021935acc2b8f38746aeab5eaa06f447be0cfff20b38811e273023cd035f14ad3a7babee646909282cc3ef	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\4C7C2E87F0BC79A039D39B05F899A1CC521FDE99\Blob = 0300000001000000140000004c7c2e87f0bc79a039d39b05f899a1cc521fde992000000001000000c3050000308205bf308203a7a00302010202046e271780300d06092a864886f70d01010d050030818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d3135301e170d3233303830373133343834335a170d3330303830353133343834315a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3730820222300d06092a864886f70d01010105000382020f003082020a0282020100ad280d5cfb35f4129a580996209e83cd117cab917f7f8b85e353c39899fa07bc7050077db622fe4b43c477c0abb8325a1ee90f76416e2af5cb76ed9ccec153694c6add14358e1c5c45d32db721654781ba134e981ae3b21d56fe739afd397db8101fa65554ad67d9b808d45487d9913bd7cf30e094a948546da75f51395ab7b0f122244976683d87ce6797aaea3d5ee468553fc658b2b9530e33e2aa418950458d4147270f8773e3d93da7df6a1e8f58e439218236d110a658bf5037260d3f596e1f06b9e963f758eca3f99faa454640628e3bc66c16e914aad9bea5a47f954ca0ff73cf4237e8545e5e82f66795493508a6852f4564ef44dbb31b23c27d6dcc54e749094bb404073ed05ab6bf54afadec8ea7b58ce2d935c4b0ec8a054bef86cebfd63faab8fae41104e8bdaf1f3f2474d78e050c8f33510c80abba83c0da198107e47b40cd119b71827a510ae65e9b97d5e617b397cf517cfecbc47a890bbc350c5b631a50f254151d4d84cd512e0f57241e10b1bd1569287a900d4bf4a23532556266bc1c8b1014972f126b20a2e2e7db73774eb822669fc2bcf56d817ee3f5d20f9b029ec62d377d5328000ce5d921c965337c500416a6c3e828ed27ad8ed370f8b9035c322ce75ed6de25002e363475f95e24ad6e30b9350eb2934a431bf09c8b4df073213fd6393192d796022b4275a73e5b4a2bf3b226d6a537e96c450203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d05000382020100315188a437cb6a526ab679d888ef1051ea301191b36ff818d3e7e1b8cbc8e1c078fc058e0d7bd61b11fd8efef27b411c3f494f6734c286008ffb39d2eecf012929913628c5b160f6ca24fab63068fc48cb91293fc302f3d16f5de8dbdfe3a57abca9a081c4cfa82fa3e06f36a318251a351c5e08fe4f4a286d1ebb4bf87278f7e54faf53e1b37148f19f210136c5f3b5981a89a3aaf8351490555d001aee6c9ab2bd27cc13d162ef6314c47fce2c668e16ed641d2b6871ef3b0afbc8e5e2b93d775049061496057a361c2cd1ed7cbdadd143a0f114e9d5066c6e2f2bfd771b44c8979cf0f094d2d89e104c935ef362eabcccda4559bb33e640b3c1920cf314688fdc639665e8e81f6b9312516d937a6db751fd39e044271432d0e83bfcb5e8df5cbe2a7c15e272e09aa96f939ac7b6655fcfe91e59474b3a4cecf12490cb1f3aa2a80ae53cbe867ccaeff9ca84d487bf438f4213b253148ff8be54caee1e4aa157353f707a966f946e89a8fc8964849eb948bd54b2b2e6d1dd85ba7df45208206472a5aa93860c5ee8f6460739ea3231ec590f09602ff29f09ecedbdbd635cb42670c8288b3f051dd6c393240d0a668b9a2c20bd70f182ce58d152089385ab717c7c624826ec39424050ad45048927d2e771be6f6693055589f3612df47c206d6ae8600f9d60f7aebc5567458d8a423b76d6082ab213fff88584909e76b458ab	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\A5C8D928986EC17FCC7D5F2353885D1709B73A29	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\SystemCertificates\AdobeCertStore	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
2052	msedgewebview2.exe
2052	msedgewebview2.exe
3932	msedgewebview2.exe
3932	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4140	msedgewebview2.exe
1708	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 1708	3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe	90
PID 3124 wrote to memory of 4140	3124	2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe	91
PID 4140 wrote to memory of 1996	4140	msedgewebview2.exe	92
PID 1708 wrote to memory of 3968	1708	msedgewebview2.exe	93
PID 1708 wrote to memory of 4492	1708	msedgewebview2.exe	94
PID 1708 wrote to memory of 4492	1708	msedgewebview2.exe	94
PID 1708 wrote to memory of 4492	1708	msedgewebview2.exe	94
PID 1708 wrote to memory of 4492	1708	msedgewebview2.exe	94
PID 4140 wrote to memory of 3216	4140	msedgewebview2.exe	95
PID 4140 wrote to memory of 3216	4140	msedgewebview2.exe	95
PID 4140 wrote to memory of 3216	4140	msedgewebview2.exe	95
PID 4140 wrote to memory of 3216	4140	msedgewebview2.exe	95
PID 4140 wrote to memory of 1456	4140	msedgewebview2.exe	96
PID 4140 wrote to memory of 2332	4140	msedgewebview2.exe	97
PID 4140 wrote to memory of 2332	4140	msedgewebview2.exe	97
PID 4140 wrote to memory of 2332	4140	msedgewebview2.exe	97
PID 1708 wrote to memory of 1876	1708	msedgewebview2.exe	98
PID 1708 wrote to memory of 1376	1708	msedgewebview2.exe	99
PID 1708 wrote to memory of 1376	1708	msedgewebview2.exe	99
PID 1708 wrote to memory of 1376	1708	msedgewebview2.exe	99
PID 4140 wrote to memory of 2596	4140	msedgewebview2.exe	100
PID 4140 wrote to memory of 2596	4140	msedgewebview2.exe	100
PID 4140 wrote to memory of 2596	4140	msedgewebview2.exe	100
PID 4140 wrote to memory of 2596	4140	msedgewebview2.exe	100
PID 4140 wrote to memory of 2596	4140	msedgewebview2.exe	100
PID 1708 wrote to memory of 1856	1708	msedgewebview2.exe	101
PID 1708 wrote to memory of 1856	1708	msedgewebview2.exe	101
PID 1708 wrote to memory of 1856	1708	msedgewebview2.exe	101
PID 1708 wrote to memory of 1856	1708	msedgewebview2.exe	101
PID 1708 wrote to memory of 1856	1708	msedgewebview2.exe	101
PID 1708 wrote to memory of 4732	1708	msedgewebview2.exe	107
PID 1708 wrote to memory of 4732	1708	msedgewebview2.exe	107
PID 1708 wrote to memory of 4732	1708	msedgewebview2.exe	107
PID 4140 wrote to memory of 3248	4140	msedgewebview2.exe	108
PID 4140 wrote to memory of 3248	4140	msedgewebview2.exe	108
PID 4140 wrote to memory of 3248	4140	msedgewebview2.exe	108
PID 1708 wrote to memory of 4464	1708	msedgewebview2.exe	109
PID 1708 wrote to memory of 4464	1708	msedgewebview2.exe	109
PID 1708 wrote to memory of 4464	1708	msedgewebview2.exe	109
PID 4140 wrote to memory of 2320	4140	msedgewebview2.exe	110
PID 4140 wrote to memory of 2320	4140	msedgewebview2.exe	110
PID 4140 wrote to memory of 2320	4140	msedgewebview2.exe	110
PID 1708 wrote to memory of 2052	1708	msedgewebview2.exe	111
PID 4140 wrote to memory of 3932	4140	msedgewebview2.exe	112
PID 1708 wrote to memory of 3300	1708	msedgewebview2.exe	113
PID 1708 wrote to memory of 3300	1708	msedgewebview2.exe	113
PID 1708 wrote to memory of 3300	1708	msedgewebview2.exe	113
PID 4140 wrote to memory of 4640	4140	msedgewebview2.exe	114
PID 4140 wrote to memory of 4640	4140	msedgewebview2.exe	114
PID 4140 wrote to memory of 4640	4140	msedgewebview2.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe"
1⤵
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3124.3464.10445326911685778202 /pfhostedapp:c1b043d7a416c7e6a83ee6f4f836885b76623c99
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView /prefetch:4 /pfhostedapp:c1b043d7a416c7e6a83ee6f4f836885b76623c99 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffdabc55fd8,0x7ffdabc55fe4,0x7ffdabc55ff0
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1728 --field-trial-handle=1732,i,3622678249727205098,16031637815859979963,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:c1b043d7a416c7e6a83ee6f4f836885b76623c99
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2348 --field-trial-handle=1732,i,3622678249727205098,16031637815859979963,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:c1b043d7a416c7e6a83ee6f4f836885b76623c99
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2376 --field-trial-handle=1732,i,3622678249727205098,16031637815859979963,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:c1b043d7a416c7e6a83ee6f4f836885b76623c99
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3380 --field-trial-handle=1732,i,3622678249727205098,16031637815859979963,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:c1b043d7a416c7e6a83ee6f4f836885b76623c99 /prefetch:1
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4592 --field-trial-handle=1732,i,3622678249727205098,16031637815859979963,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:c1b043d7a416c7e6a83ee6f4f836885b76623c99
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4612 --field-trial-handle=1732,i,3622678249727205098,16031637815859979963,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:c1b043d7a416c7e6a83ee6f4f836885b76623c99
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4704 --field-trial-handle=1732,i,3622678249727205098,16031637815859979963,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:c1b043d7a416c7e6a83ee6f4f836885b76623c99
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=1732,i,3622678249727205098,16031637815859979963,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:c1b043d7a416c7e6a83ee6f4f836885b76623c99
    3⤵
    PID:3300
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3124.3464.4939047850968422490 /pfhostedapp:573f7a273674f1490f98eaa3d6bd4de8ba87f367
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView /prefetch:4 /pfhostedapp:573f7a273674f1490f98eaa3d6bd4de8ba87f367 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x108,0x168,0x18c,0x104,0x194,0x7ffdabc55fd8,0x7ffdabc55fe4,0x7ffdabc55ff0
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,13137342936647856238,892691292518961969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:573f7a273674f1490f98eaa3d6bd4de8ba87f367
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2496 --field-trial-handle=1756,i,13137342936647856238,892691292518961969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:573f7a273674f1490f98eaa3d6bd4de8ba87f367
    3⤵
    PID:1456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2500 --field-trial-handle=1756,i,13137342936647856238,892691292518961969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:573f7a273674f1490f98eaa3d6bd4de8ba87f367
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3344 --field-trial-handle=1756,i,13137342936647856238,892691292518961969,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:573f7a273674f1490f98eaa3d6bd4de8ba87f367 /prefetch:1
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4720 --field-trial-handle=1756,i,13137342936647856238,892691292518961969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:573f7a273674f1490f98eaa3d6bd4de8ba87f367
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4736 --field-trial-handle=1756,i,13137342936647856238,892691292518961969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:573f7a273674f1490f98eaa3d6bd4de8ba87f367
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4740 --field-trial-handle=1756,i,13137342936647856238,892691292518961969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:573f7a273674f1490f98eaa3d6bd4de8ba87f367
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView" --webview-exe-name=2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4428 --field-trial-handle=1756,i,13137342936647856238,892691292518961969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:573f7a273674f1490f98eaa3d6bd4de8ba87f367
    3⤵
    PID:4640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.adobefeatureflagnotification

Path C:\Users\Admin\AppData\Local\Adobe\.adobefeatureflagnotification
Size 13B
SHA256 e846f39362168bce024ac0d6df571586cf0146d87daa4d558ca3db5f854137f7
MD5 422bdb7b1334bb4524561f872891b49f
SHA1 0116a25599eaf2a0b6b9c90a20be7872efb7b552
SHA512 47345124fc89c9ccbc8f6960bef6300268439e6deb3726185342727042df8f6cee67ab373d5b8668000d2a3a190085995ae59656b38ceacef4161e1af3fb9523
MD5 SHA1 SHA512

Submit Download

36d1f83a-ff86-4263-91b3-025f14d09150.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\36d1f83a-ff86-4263-91b3-025f14d09150.tmp
Size 14KB
SHA256 cb41cbe327f8694345cf4062bc563926b34f3ca47000ba417b081c858b496486
MD5 a42cbcd4c709eabda4543ee870a0be80
SHA1 e1190f57095377ae178683b52e72566ac1a23ea9
SHA512 c16ff2a5b0b5893bd5519dde02d8daa474d870d0af928fafada0dfa1590d00f900b4d83488f02add2978e55b611173e7b78f45010eb288c2abef0d5ba13fbe32
SSDEEP 192:1DFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4k8NBSpSeoDUh2PWLQ:9+aQikB+z/xvxjg/qhEANBSovung9z/
TLSH
T171629E2B65787D3795F3FA01394A1B8FDBB99472A0C16BBC4ABD1F0D06C32980342917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e687ec8-3581-4742-9051-706da34e6198.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\9e687ec8-3581-4742-9051-706da34e6198.tmp
Size 3KB
SHA256 d45fe49a430cd4798dd174ab0e859ea4dc016818d168e01d0e265df69d052fe8
MD5 86f7f8863b2546fb39861079ef2c8d51
SHA1 75b8f32e2c376343d9ddc2f4d00ab7e6d92d5a39
SHA512 eef05226351865599d74478a5e8f88da542a2ce464434d820f9f851160e5e4454a8cd32f267efa893a106a11328a3911ac799a4d011466c6b8cf988f2c0c271f
TLSH
T1A971A822A874B97B4DF2E5017D863F07A7B95063E5913FA9DAEC0F0D01D72881342D27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 300c3e91148bcd02af4f0a783ace602f899b4eab89200b7cd5d89d72d164097b
MD5 a79876c336f4ec3f86001a1714092583
SHA1 fb39678cb272043a5c1dcf22666f06f9491c8f7e
SHA512 e95ab7d63d1d1a38494be4358b557e1f7db4d81ac753aed74faa04090527694f40330e875a4b1bc0e174e2a667dab625bdb1c3a5dfa1c50b18aaf84d6a1e4277
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 74edf71da9b1e7ac852db5505c7c1075404daf6d5714dd3694b01625311ea54a
MD5 d4cb1cf8e8be28e71f34bae90be9eb2f
SHA1 8c94f702f476491505ecb2aa009e917503ee2fdc
SHA512 ee6702adf02411135957e39a58f900221a91b5999461db4d278fe3b6a1998f57ba2181555144f9a2cf75207ef3a51404eca393d9a9828228b527ea75cb30ca8a
TLSH
T176D0121772410538C01035330502F10C0600C50BC14590005839C51E6B080941907442
MD5 SHA1 SHA512 TLSH

Submit Download

539922a4-81d0-4062-b008-8484189c246e.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Default\539922a4-81d0-4062-b008-8484189c246e.tmp
Size 6KB
SHA256 bf4f0737b341a841b145cd9d9893b0a194f51d07e6db2fb7e86c2f4dea21161d
MD5 3ef63ed2b531194365309b96e9151795
SHA1 cf33cb356118cff2c63f1da70391d1a82bfa9e73
SHA512 d7a6dd75fb6f82a873cfc8aa95155d5999e5089091a6f4d031a818af828503e80f06b36e3a4dbd2890db62868a65eaf8925f97f20b670e2af9ec921ccbde3b9d
SSDEEP 96:stgU/dA1CG3b9nkqo5h16Zdvs7/x+6Mhmuecmxze2K+gSj28XM1C7K:stgYSBjosvsV+FixzycjG6K
TLSH
T16AD186025E24787B8CC6E519FA69BB17E2F5607271E11E5CEBF8452C08EB6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

719df394-1442-4230-bdef-bc48d062a301.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Default\719df394-1442-4230-bdef-bc48d062a301.tmp
Size 6KB
SHA256 0c97cfd9c08c908cd5036c58ea97c48c799ec2d4b7325e361dcc20d87af2f94c
MD5 ad66ea972ec583f2e381d7863815cae3
SHA1 005ca80708ac187bbb79958142975faceae26bd3
SHA512 fa4ea76004dedbd4791415ae1310465a713e1eb20103ced4703fec0b7365dfc1e4be5d0f5611f046ee9a9d4f88a1645b9fe4b82bbdf1e5ca2c1aded53cd1b6d0
SSDEEP 96:stgU/dA1j3b9nkqo5h16Zdvs7/x+6Mhmuecmxze2K+gCj28XM1C7K:stgYSPjosvsV+FixzygjG6K
TLSH
T105D175025E24B87B4CC6F519FA29BA17E2F5607274E51E5CEBF8462C08DB6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network Action Predictor
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

2b8b13d2-65fe-447c-bafe-5dbce649336d.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\2b8b13d2-65fe-447c-bafe-5dbce649336d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

4e05b90c-ab91-4110-8395-2524d23578c7.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\4e05b90c-ab91-4110-8395-2524d23578c7.tmp
Size 230B
SHA256 27c739561615160aaec0e7ed7f318ddb661114fd768ee1f72dcccbe4e82ea588
MD5 75ad241bc81224195f620e20abcad795
SHA1 ee4b68e146b88c8b3c128a837611f006e512bab3
SHA512 d47860e196e7b0a406bbda570f28058ad5c36d6991b3523074345e144e093a9e81416ca2f147ca3210932d591351ebd2f3fd5335b55087d091815b5476ebd1b5
TLSH
T1EFD0A77A466019FE075543A05928B81BCEBE5003021CFDBA95347B6A83761B8901458B
MD5 SHA1 SHA512 TLSH

Submit Download

6ccfd016-89eb-42a1-9c3f-3e2547738ea8.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\6ccfd016-89eb-42a1-9c3f-3e2547738ea8.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

8f3d79f9-f036-421f-9304-60fa9e5b8d7d.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\8f3d79f9-f036-421f-9304-60fa9e5b8d7d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 1KB
SHA256 16f3c001e0cb854b9f4bf99d83acc1edab0413816a3b1e58cd27ad021e7cd594
MD5 c6394c9912385577d66b8ab9ddb33c3c
SHA1 0419e6a2100a3f3a43f6b7f9eeffedc24c866289
SHA512 b0dadaefcebde6c8690cabcb7c58d103a70090ac45d330508ceea5ce29758c6430a60772c088fcc37352485860a93d8179fbafa80aebc9da7a7053c09ef7ecb5
TLSH
T1412162B2E8B4AB329DD2B6423603BBAB5F356067C1504F09A6DD8F2D02D305D3626837
MD5 SHA1 SHA512 TLSH

Submit Download

a950bca2-ed96-4a9c-a5ed-adac2c168bb9.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\a950bca2-ed96-4a9c-a5ed-adac2c168bb9.tmp
Size 3KB
SHA256 a65c9b977941fd1dcd7678b37cf353f098fb41967f6da3d766c904ce477185ec
MD5 a67dbdbb688bd788b2aadb7a2cd7cfc1
SHA1 5e76c4fc8521bd54731713f33886b84422c6c976
SHA512 fcaf86b36cfba3aafb39a9b7997aefce55d8b8a1a79ca29202570373d6b8519b2164bd9e9ed1dfea8ae52fb8c5b07b68ca6dd77bf54877cb40d7c5c4723db2c5
TLSH
T189618637AD74F93B4DF2DA0179863B16ABA55123E5913FA9DAEC0F0D01D72982341C27
MD5 SHA1 SHA512 TLSH

Submit Download

b288295c-18a9-4fe6-ac21-2900fd1095bf.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-01_6292f2d1b82a62c21c8b458c693778a3_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe\EBWebView\b288295c-18a9-4fe6-ac21-2900fd1095bf.tmp
Size 2KB
SHA256 d0853ed411627e98badc65dfd5795d0befef2ed2aa329b167bf9bc2f85e16e26
MD5 3cfa373778647e13f4fc68c96ec9c83f
SHA1 edfd0f4b78808622ac2c95331f6a36418792779a
SHA512 c0eb9e21de74f315fc9bcb1acd3d03e10963c360624f62b3aa5d1b158b222eb38a58787dcda7545ad20f68c93218839ab0358e2f3c9ca8c326395e1a1e86e2c1
TLSH
T120518333AC24BA7689E2960179473F278F7991A2E6611F69AADC0F1C01C755C2342C3B
MD5 SHA1 SHA512 TLSH

Submit Download

WAM.log

Path C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\WAM.log
Size 952B
SHA256 92d288b0fc779f854bea8106f77954a9080752713f28fb84268dd82ed9781975
MD5 74235afc950cc1935d54c6fed642a8e9
SHA1 69f82f312539943dd99da29e18ea71b85ec2319b
SHA512 90f1e57521deb90f4872d0cea571540694a78b7c92a38c34a9a6418be08bf6f036b62e33b2b9a8e8ef51a60e91abbad9cfaa4d87b0337685ea1e9cd441290c4b
TLSH
T11B116D4B26BF1E05F5E6E7116EBAE111FA373CF66834831C13A1020E0B6DA00B85177A
MD5 SHA1 SHA512 TLSH

Submit Download

CCDInstaller.js

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\CCDInstaller.js
Size 1.8MB
SHA256 a7c3bb9c229a1a762cb9357424645cd3ab94827ad7723ff9042ffc519a7719ab
MD5 fa67ff9d3b311440acb2bb3a869cec4c
SHA1 6d4c65b2c97c5d8e41d7a0a8b47f4914ef4a6db4
SHA512 a82631b21f41f3da992fc6b23b7031b693ff09f37969d46ce9dd6a6679105491ae761086c7d7ff5d5a29c374f199b1cc62fbbab99e3f9bd5c692a993b6e82ed8
SSDEEP 12288:iaG4OTgPpOJ6Ain0mbHksFSGp6IGqEiiG9/wCuyFe8CRc9TKjbRq7uHuJodMg:bdk8bHkRGpePiiG9nCRc937zJoV
TLSH
T11685E77E74A5A872AF8030A6009BB40F77743539734084A89955CFADD2E6B8D4F0BE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01ad294f-1e9d-4f81-945e-56c51008e04b.tmp

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\01ad294f-1e9d-4f81-945e-56c51008e04b.tmp
Size 3KB
SHA256 f20a7f1eb1445412647fb4cd0b781d01182754078e7f67e68753314b7fd2f658
MD5 5113a99d47edd4fb1ecbe968780cb2d4
SHA1 51a2c07ce74fa0adba14e8fff4eeb7dc4da4a5b8
SHA512 7c5c492aa6cd016493d02ba267b5c3fd97d77680e9b33fc1f4c4ca32ed87ea984b1608410f346d3b715cc29e2236513fd0f2a7ecdbac1e6ded260dfbafc89260
TLSH
T19F618537A964EA7B4DE2860178863B0A67A59123E4A53F69D6EC0E0C01C728C1342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

1786a30e-37d5-4559-b89c-c406b61ad7bc.tmp

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\1786a30e-37d5-4559-b89c-c406b61ad7bc.tmp
Size 3KB
SHA256 1b590a59756935abf1ddfc9e008d2e421e9a8f8911c229a3cf32360019ba4953
MD5 c5f14bc390ad12d74194b5188e94fd56
SHA1 e20d14adf287d8fe85b43e31359038d2df1593c2
SHA512 5862fc0f5677d1d13fdf8b4985d60c5d990384a529d7e2bb780cab4c222f38074ebcf019a41343787179ed36d1220a2db9eed2413c08cd9151cdebbde000dd00
TLSH
T1EB718523A974BA6B4EF3C64579863B0B66B49123E4953FADD6EC0F0C01D728D1342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

7ef173b4-2f8e-4e61-8d8d-79cbb664412c.tmp

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\7ef173b4-2f8e-4e61-8d8d-79cbb664412c.tmp
Size 2KB
SHA256 5406bd4fcaace4d0f47cc843319e8170f21278a2a509a9b626815b1eea439893
MD5 9500539fc69cad806f52abcf87cbc7bb
SHA1 fbf532cc3aff19a7a7c3c5f21700e958d8843bea
SHA512 75de91be1b89aeb032d8004913f300c58ee4637029bf82ff35bcb584a5c067850b31e7dc171a9e40450606ff3654e737a51d840f0a3272a1372a1ff896ea4c7c
TLSH
T1F551B433BD14FB7B85E286557D4B7B1B8A78A1A299721F24A6DD0B0C00C715D2342C3B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 aee329392a73229bd7479c70dc4b1582e2094f13fb7139819196ff1944a045d0
MD5 9d08c63971c112ee8b6f3ed9a57bf47e
SHA1 091503abcf979351e74ba72b6e98c205018e35fa
SHA512 345f3229ba9ad5a657e29379cf0aa2ef319dd7d898358279fcba665b54b4bb74d8662c7b477b1767d73ff05674f4a17d2481fbb03e7081a8752916e4db8a7888
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7c4a3361ae688e995d388850807d259e5010d572a643e59ea311139cc63b527e
MD5 79dbff388a1705093cdf3b80fac8c96c
SHA1 3d64fa141c9abac68d97bec754764f102dadde4a
SHA512 b504dac51d38b1c3b0ec7bde62e6739d9f2c7a25529b956d28e15304c0cc37d02dfbfeb3e2f97f6ced2b6c07e4818c2f08f10016d81c7be62c30dd556ed7ac85
TLSH
T162D01212322106B4C0253033060375085500D10B404640449C38C51D1A140581912843
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8a3692e8-1350-4417-9653-5472ee03733a.tmp

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Default\8a3692e8-1350-4417-9653-5472ee03733a.tmp
Size 6KB
SHA256 14fd6b03fdc4272385683a884a96d720fa9d2d18fa9fa28db9dc886806a98f9b
MD5 8a5b27bfbaf7b1cfe858a018a211541b
SHA1 87c296838d346c9d10ba1767b6af32fa660eada0
SHA512 14684b2d3eae6cfcf2a9fd74dc76c78612c9807dbd83ca02b06242832716b326e0f30fff29a929da5219b2aff2b2b3997c9c247a8a7fa128512db36bcf1c2220
SSDEEP 96:stO/dABWGdrb9hk6o5h16ZvSs7/x+6MhmuecD3l1eje3K+g3+28XM1C7K:stWSZ/NoqSsV+Fv3lQjpB+G6K
TLSH
T1EED1A6025E28B97B4CCAE119BA39BA17E2F5606271D51E5CE7FC451C14D75DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 264B
SHA256 987f084c7bf551cec369f6ce769aaba9899d7d0f69fe588601859a6314c03284
MD5 00aae9e2b5b2b8b76ecc738fad2f4338
SHA1 1b646bd94c8ae9515366f9d27bfe60ab699251ee
SHA512 1f33ec66cf8022099ab12c96dd25b8fc82f853a0435559aa21d62ce7c9e9e4d29b743ec3bbc59c89d4fcdc069e31187638d92cdf13c46d3cb78b57f3867e6d9a
TLSH
T130D0C96A59D5CEC5D3081770F9E3492C36F6663F13A72E06643C5374BC353589619612
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 4a2b79bbd234010964a541fc333873a5048bec0e1828b4ad0108a20504f13dfb
MD5 ff80cc22e1056e887b207ea2a72e358d
SHA1 339bb29d13d2c8e4f1f9e216bcbbc4c57ff94f80
SHA512 4df790f1781eb7bc75c43befc533f972881e4883372610df3242101f87c27fa35b1f40d0244067a5c49bb9efcbe8cf92bb0678a48af75479f36066dbdd4bbbf4
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Default\DawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Default\DawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Default\DawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

3fba7bcd-7bd9-41bd-a76a-9d93d4755a6d.tmp

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Default\Network\3fba7bcd-7bd9-41bd-a76a-9d93d4755a6d.tmp
Size 1KB
SHA256 ec601db398a738d44ad07f47e782f05d2724305fc84b5e48abccb001d6eb0a8d
MD5 caacfa8dcde90a8f74224cc9a08fe0cd
SHA1 43fb5a71aee0e2ece4866c7c359f738eaeca5f8e
SHA512 d964b8c950f8f977741197b8546382463fa42bfc2053d6132f7f9c89a4fce56121f8ad8cf6afbfffcb14841c65042774d92ecae9de18e060b6c17b6e211a376b
TLSH
T1B14118F783B8152D8A5391F45B28DE1FCF9E1811876CEA39C9D05EA793A14B1E210B4B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Default\Preferences
Size 5KB
SHA256 a77ea8606853f6695e451654e6f642e8138760a44ea4ebb2c862bf54366d5d44
MD5 39b3d8dd57bf31d700415c979d427a11
SHA1 77fdaaa69723983db944a19924f10dc068f6c8f6
SHA512 ee24b8fe3b4de6c8b000e950c6f2af0c57e419f3385d2d29709faf675094d6084a97a70a179e578b105346ecc21215462746e1c2283bfbb4b7c7a76cff78edc5
SSDEEP 96:rO/dABHdrb9hk8do616ZvSs7/x+6MhmuecD3l1eje3K+gY+28XM1C7K:rWST/FoZSsV+Fv3lQjpC+G6K
TLSH
T130C1B8025E28B97B4CCAE109BA39BA17E3F6613275D51E5CE7F8862C18D75DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb970ab8-11ff-4a88-b916-ea2c9b86b77c.tmp

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Default\cb970ab8-11ff-4a88-b916-ea2c9b86b77c.tmp
Size 6KB
SHA256 1d9025ec7594f10602fcbe8296572bf667bfc1267df61280a3c4cbb1fce16e44
MD5 5cc302d89bfc34778d4c9587c86200b0
SHA1 fe0469564ad780ce615ca2e52fe22becc377a307
SHA512 f05f7b31a5744dfea9e09fb902f100aabb9eacb4e1e701f9ab514aa49e0bcb5a55c6eb15919a0f86d9ed184c155d9f881ae0809de432cfcbb9870544d4ef29c6
SSDEEP 96:stO/dABHdrb9hk6o5h16ZvSs7/x+6MhmuecD3l1eje3K+gY+28XM1C7K:stWST/NoqSsV+Fv3lQjpC+G6K
TLSH
T1A1D1B7025E28B97B4CCAE119BA39BA17E2F6613270D51E5CE7FC852C18D75DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\Local State
Size 1KB
SHA256 8759bf51d891ce541f28016cfa18df4bdf99961245290750db3ec780c96d4f19
MD5 27e0926395122866af2cbba4a008de93
SHA1 3119d2cb6fd019a82bda24d1e01aa2fe9b2993a8
SHA512 bed93bde8f8b3a84e5a6ce7a9f7856c338cbd52e21ffa3b9d4ea4f210986b31bd1ca4e2cf1f850381fd4c93a2c5535d89ba6b17264674c4f4cbb362938dc51f0
TLSH
T1C6214273EA64AB73A9D262973507B70F1E70B1A781714B1862DE8A1C01D704E6627C3B
MD5 SHA1 SHA512 TLSH

Submit Download

d35562a7-c5d3-42cc-9931-1aaa45322290.tmp

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\EBWebView\d35562a7-c5d3-42cc-9931-1aaa45322290.tmp
Size 15KB
SHA256 104016dd4490b376013cf7aaa9ecb78d54ca819b6749a3ab97470a47876004df
MD5 ae5a7c11d5cadd85ff18761498cf33c7
SHA1 7c80896e35b54ec3f0a7c3d322801498da0c26a6
SHA512 9678a446ca567e7d5e9e541e4a3644e20240cd20866ffca235ffce80d8e6a4847151e2754ebc7e88284d7e7b52af0804177ed5f9d1a7b1ef4fbf3678a7eea72e
SSDEEP 384:m+aQikB+z/xvxjg/qhEwNBSa099ZRBL9zR:x/UxvxjgC+iA3R5FR
TLSH
T13E72AE3B99283E2396F7E605BD4D074FCBB994B390C26AB84ABD4F0D06C72980342D47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.css

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\index.css
Size 918KB
SHA256 a388389e33ebb569d5e4bff4a87223ca0e540d5670127bb2e7ecb01207d34b61
MD5 4cede05ad3c27ada493516d8b3f624e4
SHA1 282d15f4e7fa5c884acf9918f7d0722f4503db71
SHA512 e5053d65f92609aa98d9de734ff50ebb1c4b1755a7dc17c1a8b1b1c7eedeecf124d53d2baf77016ca43623d055096bd7e8fad7ba54dea2903bd67e6296db422a
SSDEEP 12288:ojx5xiaHbr3Gq5XRi5i6jE/5acgsu0wxT63kaSROcdOLeK+CnjG1VWzWhHuaaOGh:oZBP3/5XSo/5F5K65SROcwLeKVYgzWI5
TLSH
T1FA15CEE0D6A04D2D74378C3A61CEA75A5514C28E55889FDBEE83ECF540CA696CF2270F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\{881242C1-C725-4962-8726-8FFDA380332B}\index.html
Size 426B
SHA256 886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375
MD5 a28ab17b18ff254173dfeef03245efd0
SHA1 c6ce20924565644601d4e0dd0fba9dde8dea5c77
SHA512 9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6
TLSH
T1A9E0225B1D924C1C62701BB4D9E2F82DCA45B64AA743AE2074C5256B6FB2B88CCCB64D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_2132539086\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_568180747\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_956954932\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_1940352228\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_278044664\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_905228121\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4140_905228121\manifest.fingerprint
Size 66B
SHA256 bc8d4367c67f869cbf134ee18cc34007003022251fd5d54980fae22d990f1563
MD5 c3d8ccd4813a33b2ad5ece6575c67046
SHA1 0630d245e905f65fbb619c087fa117559ca170b0
SHA512 4691eb27a8f859aae2a4bbe5727a927674cfda0f9970d7384f01761705097bd8629562d0cef462551b9ae5699074e0d5cdb68a3e82150b21f3063012c1eb4ea5
TLSH
T1CEA022C2F2A20022C8030382A38A00008008882CCEC32030002E0E3BC02F0020022A00
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2052-686-0x00000236CFFB0000-0x00000236CFFB1000-memory.dmp

Download

memory/2052-684-0x00000236CFFB0000-0x00000236CFFB1000-memory.dmp

Download

memory/2596-200-0x00007FFDCD370000-0x00007FFDCD371000-memory.dmp

Download

memory/3124-0-0x0000000000150000-0x0000000000BAC000-memory.dmp

Download

memory/3932-700-0x0000024A0AAA0000-0x0000024A0AAA1000-memory.dmp

Download

memory/3932-695-0x0000024A0AAA0000-0x0000024A0AAA1000-memory.dmp

Download

memory/3932-694-0x0000024A0AAA0000-0x0000024A0AAA1000-memory.dmp

Download

memory/3932-693-0x0000024A0AAA0000-0x0000024A0AAA1000-memory.dmp

Download

memory/3932-697-0x0000024A0AAA0000-0x0000024A0AAA1000-memory.dmp

Download

memory/3932-696-0x0000024A0AAA0000-0x0000024A0AAA1000-memory.dmp

Download

memory/4492-147-0x00007FFDCD370000-0x00007FFDCD371000-memory.dmp

Download

memory/4732-560-0x00007FFDCC1D0000-0x00007FFDCC1D1000-memory.dmp

Download

memory/4732-561-0x00007FFDCCEE0000-0x00007FFDCCEE1000-memory.dmp

Download